Spain’s data protection agency (AEPD) has reported the country’s first-ever personal data breach caused by the actions of an autonomous AI agent. Francisco Pérez Bes, president and deputy of the AEPD, said in a Monday blog post that an individual deployed an AI agent that used a “known large language model (LLM)” to carry out the attack on an organization. The agent scanned “generic files” before accessing the organization’s system, then ran vulnerability scans to find flaws that would give it read/write access to files containing personal data and invoices. Pérez Bes did not name the LLM used to support the attack, but said whoever was behind it used the agent to “successfully chain together different phases of the attack.” This demonstrates that AI-supported attacks are no longer theoretical, he added, and called on organizations to embrace defense tools that are capable of keeping pace with the speed at which agentic attacks can be executed. “Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough,” said Pérez Bes (machine-translated). “The arrival of AI agents in the offensive arena should prompt an immediate review of security and data protection models. “Data protection officers, managers, and delegates must prepare for a scenario in which the speed of attacks will increase, but in which the same fundamentals will continue to be crucial: Understanding the processing activities, minimizing data, limiting access, correcting vulnerabilities, controlling suppliers, and being prepared to respond.” The Register asked AEPD for more information. Spain’s first AI agent attack comes as the AEPD recently recorded its busiest year for data protection complaints. According to its most recent annual report, covering 2025, the agency received 30,931 complaints – the most in its history – representing a 64 percent increase compared to the year before. And although Spain is only now getting its first taste of a security mishap caused by a naughty agent, cases involving the foremost US AI houses are already heavily documented. OpenAI’s claim in July that its agents escaped a sandbox and started attacking Hugging Face kickstarted something of a battle between it and rival Anthropic over whose agents could take the most liberties with their security. Both companies have reported several instances of their agents going rogue, escaping "secure" environments and going walkies across the internet to attack unwitting organizations. OpenAI has been circumspect about the true scale of its rogue agents’ damage, as third-party reporting showed more websites than it was letting on were taken over. Similarly, Anthropic has said that its AI agents had, in four cases now, accessed third-party systems in attacks that, if carried out by a human, could see them convicted under computer laws. ®

Texas utility CenterPoint Energy has confirmed that an attacker broke in and stole customer information through one of its internet-facing systems. The company disclosed the breach in a Form 8-K filing with the Securities and Exchange Commission after a post on a cybercrime forum claimed to offer its customer data. Houston-based CenterPoint, which serves around 7 million customers, said its electricity and gas services remain operational and undisrupted. "While the investigation remains ongoing, the company has determined that an unauthorized third party obtained personal information relating to a portion of the company's customers through one of the company's external-facing systems," the filing said. "The company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law. "The company reported the matter to law enforcement authorities and has notified certain regulatory authorities of the issue." The person claiming responsibility said they extracted 7.49 million of CenterPoint's files from a poorly secured API. Among the data allegedly available to download are customer names and contact details, billing data, move-in dates, driver's license information, and the last four digits of Social Security numbers. The Register has not independently verified the contents of the alleged data dump. When we asked CenterPoint for comment on the veracity of the claims, it told us: "Our filing speaks for itself." CenterPoint said it does not believe the incident is reasonably likely to materially affect its financial condition or results of operations. For operators of critical infrastructure, cyberattacks can lead to far worse outcomes. Recently, disruptive attacks have been recorded at facilities in Poland and the UK, and more than 100 US water systems were affected by attacks in July. The US consistently warns about the cyber threat facing utility providers from hostile states because successful attacks can disrupt essential services. ®

Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Windows and macOS devices with information-stealing malware. A Reddit user uncovered the infostealer ads on September 6, noting that the ad showed u/hbomax as the author — this is the verified HBO Max account — and advertised a macOS app for HBO Max. The streaming service does not offer a native client for the Mac. Anyone who clicked on the malicious ad would then be taken to a “somewhat-legitimate” looking landing page (hbomaxx[.]us) that includes a join/download button. Clicking the button produced instructions telling the user to copy and paste a command into Terminal on macOS. The Reddit security sleuth described that as “the classic infostealer/clickfix paste this command to download,” noting that they tested all of this in a sandboxed environment, and didn’t actually run the executable on their machine. “My guess is that the Reddit account is compromised,” they concluded. Three days later, Reddit paused the infostealer-dropping ads, and an admin said the social media platform’s safety and security teams were investigating what happened. HBO Max’s parent company Warner Bros. Discovery didn’t immediately respond to The Register’s inquiries about the account takeover - including who hijacked the streaming service’s Reddit account and how they did it. Maybe someone who didn’t like the House of the Dragon season 3 finale? We will update this story if and when we hear back. Researchers at Hudson Rock and ADAMnetworks analyzed the ads, and in a couple of reports said the HBO Max account hijacking was part of a “massive 48-hour malvertising blitz” that pushed 108 distinct ads using multiple software lures. They named the campaign PasteSwitch, and said it serves up targeted malware aimed at victims’ operating system - either macOS or Windows. The payloads include infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications. The cryptocurrency clippers - PasteSwitch delivers either AnimateClipper or ZigClipper - also provide blockchain-based command-and-control fallbacks for the attackers. They use Binance Smart Chain (BSC) contracts to dynamically fetch whatever C2 domain the crooks are using at any given time. “Between March and July 2026, researchers observed 36 mainnet changes executed by the same attacker controller address,” Hudson Rock said. “Because the C2 domain is hosted directly on the blockchain, the infrastructure demonstrates dynamic resilience, allowing the threat actors to easily rotate burned domains.” In addition to HBO Max, the attackers used developer-tool, disk-cleaner, and AI-themed lures, including fake OpenAI Codex ads, which crims have previously used to push Mac malware. Of the 108 ads, 46 used an HBO Max lure, directing app seekers to either hbomaxx[.]app or hbomax-macos[.]com. Another 36 tried to trick prospective victims via an OpenAI Codex theme (with a codex-craft[.]com) landing page. Of the rest: 15 purported to be a macOS disk utility (apple.clean-disk-guide[.]com) and 11 used other developer tools as lures (code-desktop[.]com). “The campaign proves once again why trusted distribution channels are becoming prime targets for infostealer delivery,” Hudson Rock co-founder and CTO Alon Gal said in a LinkedIn post. It also shows that miscreants continue to make heavy use of ClickFix attacks, so there’s little sign this social engineering method is going away anytime soon.®

The International Meteor Organization (IMO) is watching for fireballs again, but much of its website remains offline after a cyberattack that it says will take weeks to recover from. The Belgium-based nonprofit, which coordinates meteor observations and brings together amateur and professional astronomers worldwide, is currently serving visitors a stripped-down holding page explaining the outage. "We recently suffered a cyberattack that dealt a critical blow to aging infrastructure, taking much of our site offline," the organization said. "We expect several weeks of partial downtime as we transition to new infrastructure and services." IMO has not disclosed when the attack occurred, how the attackers gained access, or whether they accessed or encrypted any data. The organization collects reports from people who spot unusually bright meteors, or fireballs, and uses those observations to help document and analyze events. Its notice says it prioritized restoring that capability after the attack. "We prioritized restoring fireball reporting, and it is available again," IMO said. "If you saw a fireball or a bright light in the sky, you can still submit your observation." Other parts of the site remain unavailable while the organization rebuilds its infrastructure. IMO's warning that the process will take several weeks suggests this is more than a case of simply restoring a compromised web server, although the organization has not disclosed the extent of the damage. The incident also leaves some unanswered questions about the data held on the affected systems. IMO operates services used by meteor observers and members around the world, but has not said whether information belonging to users or contributors was exposed during the attack. The Register asked IMO when the attack occurred, which systems were affected, whether any data was compromised, and whether it has identified who was responsible, but has not yet received a response. IMO is used to documenting things that burn up spectacularly. It probably didn't expect its IT infrastructure to join them. ®